Blockchain.com Pay
  • 💸Welcome to Blockchain.com Pay
  • 📍Getting Started
    • Ramps
    • Try our Widget
    • Integration Options
      • 📱Mobile Integration
        • iOS Integration Options
        • Android Integration Guide
      • 🖥️Web Integration
      • Brand Guidance
    • Testing your integration
    • Pre-Launch Checklist
    • Customise the Widget
      • Optional Customisation
    • Query parameter signing
  • 📍API
    • Partner API
      • Authentication
      • Eligibility
      • Quotes
      • Orders
      • Rate Limits
    • Webhooks
  • 📍Regions, payments and cryptos
    • Supported Regions
    • Supported Payment Methods
    • Supported Cryptocurrencies
  • 📍FAQs
Powered by GitBook
On this page
  • How to generate a signature
  • Examples
  • Signing walletAddress
  • Signing redirectUrl
  1. Getting Started

Query parameter signing

Sign your URL query parameters

Last updated 1 year ago

Your signature helps prove authenticity, and by adding a signature to your URL, this helps prevent imposters pretending to be you.

How to generate a signature

Compute a (HMAC) with a SHA-256 hash function. Use your private key as the key and address as input.

Be sure to always generate signatures from your server side application and never from the client as it would leak the private key.

All query parameters and their values need to be to ensure signature generation works.

Examples

Signing walletAddress

import crypto from "crypto";

const url = 'https://blockchain.com/pay/widget'
const walletAddress = "address";

const walletAddressSignature = crypto
    .createHmac("sha256", "secret-api-key")
    .update(walletAddress)
    .digest("hex");

const finalUrl = `${url}?walletAddress=${walletAddress}&walletAddressSignature=${walletAddressSignature}`

Signing redirectUrl

import crypto from "crypto";

const url = 'https://blockchain.com/pay/widget'
const redirectUrl = "https://example.com/?additionalParam=data";

const encodedRedirectUrl = encodeURIComponent(redirectUrl);
const redirectUrlSignature = crypto
    .createHmac("sha256", "secret-api-key")
    .update(encodedRedirectUrl)
    .digest("hex");

const finalUrl = `${url}?redirectUrl=${encodedRedirectUrl}&redirectUrlSignature=${redirectUrlSignature}`

Don't forget to add your apiKey to the URL. Contact your account representative for how to access your secret API key.

📍
hash-based authentication code
URL encoded